CVE-2022-42717

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://discuss.hashicorp.com/t/hcsec-2022-23-vagrant-nfs-sudoers-configuration-allows-for-local-privilege-escalation/45423Vendor Advisory
https://github.com/hashicorp/vagrant/pull/12910Patch, Third Party Advisory
https://www.vagrantup.com/docs/synced-folders/nfsProduct
https://discuss.hashicorp.com/t/hcsec-2022-23-vagrant-nfs-sudoers-configuration-allows-for-local-privilege-escalation/45423Vendor Advisory
https://github.com/hashicorp/vagrant/pull/12910Patch, Third Party Advisory
https://www.vagrantup.com/docs/synced-folders/nfsProduct

Timeline

Published: Oct 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-427187.8Incorrect default permissions in the installation folder for NI LabVIEW Command Line Interface (CLI) may allow an authenticated user to pote CVE-2022-427198.8A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be use CVE-2022-42729.8A vulnerability, which was classified as critical, has been found in FeMiner wms. Affected by this issue is some unknown functionality of th CVE-2022-427207.8Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used CVE-2022-427215.5A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local att CVE-2022-427225.5In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the mac80211 stack could cause a NULL CVE-2022-427244.3app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site ad CVE-2022-427257.5Warpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links.CVE-2022-42739.8A vulnerability, which was classified as critical, has been found in SourceCodester Human Resource Management System 1.0. This issue affects CVE-2022-427317.5mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a u CVE-2022-427327.5A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usi CVE-2022-427337.5A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usi